Read the docs
TI-2023-27726 Aliases CVE-2023-50821GHSA-m32q-g43c-p863

Buffer overflow in Siemens SIMATIC PCS 7 V9.1

Priority LOW 30CWE-120Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 1), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 16), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly validate the input provided in the login dialog box. An attacker could leverage this vulnerability to cause a persistent denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix Fixed SIMATIC PCS 7 V9.1 (Siemens): V9.1 SP2 UC04SIMATIC WinCC Runtime Professional V17 (Siemens): V17 Update 8+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC PCS 7 V9.1before V9.1 SP2 UC04V9.1 SP2 UC04Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V18before V18 Update 4V18 Update 4Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V19before V19 Update 1V19 Update 1Patch availableCNA
SiemensSIMATIC WinCC V7.5before V7.5 SP2 Update 16V7.5 SP2 Update 16Patch availableCNA
SiemensSIMATIC WinCC V8.0before V8.0 Update 5V8.0 Update 5Patch availableCNA
  • SIMATIC PCS 7 V9.1 VendorSiemens Affected before V9.1 SP2 UC04 Fixed in V9.1 SP2 UC04 Patch available CNA
  • SIMATIC WinCC Runtime Professional V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC WinCC Runtime Professional V18 VendorSiemens Affected before V18 Update 4 Fixed in V18 Update 4 Patch available CNA
  • SIMATIC WinCC Runtime Professional V19 VendorSiemens Affected before V19 Update 1 Fixed in V19 Update 1 Patch available CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected before V7.5 SP2 Update 16 Fixed in V7.5 SP2 Update 16 Patch available CNA
  • SIMATIC WinCC V8.0 VendorSiemens Affected before V8.0 Update 5 Fixed in V8.0 Update 5 Patch available CNA

Remediation

  • Fix · CNA SIMATIC PCS 7 V9.1 (Siemens) Fixed in V9.1 SP2 UC04
  • Fix · CNA SIMATIC WinCC Runtime Professional V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC WinCC Runtime Professional V18 (Siemens) Fixed in V18 Update 4
  • Fix · CNA SIMATIC WinCC Runtime Professional V19 (Siemens) Fixed in V19 Update 1
  • Fix · CNA SIMATIC WinCC V7.5 (Siemens) Fixed in V7.5 SP2 Update 16
  • Fix · CNA SIMATIC WinCC V8.0 (Siemens) Fixed in V8.0 Update 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50821
  2. 2026-10-03 Alias added: GHSA-m32q-g43c-p863

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences